ci: add Themis PR review - #77
Open
austinderrick wants to merge 5 commits into
Open
Conversation
Delegates to the canonical themis-review reusable in CuratorAgents, pinned to the themis-v1.33.0 release SHA. Set up the same way as iac-interworks: comment-only (non-blocking) reviews, no cross-bot conventions or sibling lessons, and bot-authored PRs skipped. REVIEW.md is the review spec (CONTRIBUTING.md stays the development guide), covering what CI already enforces, the values interface as a fleet-facing API, the DB_HOST/-primary wiring, release-please ownership of the version, and the must-fix bar.
Themis reviews curator-helm in isolation, but the chart's correctness is defined by two repos it can't see: iac-interworks (which pins and configures every site) and curator (whose docker/config/*.php files read the env vars this chart renders). Describes both, including the docker/config vs repo-root config split that makes an env-var check wrong in either direction if you read the wrong tree. Written to work whether or not the repos are checked out into .themis-context/, and tells Themis to ask rather than assert when they aren't.
Bumps the pin to themis-v1.35.0, which adds context_repos, and turns it on for the two repos that decide whether a chart change is correct: iac-interworks pins a chart version per site and supplies its values, and curator's docker/config/*.php reads the env vars these templates render. Neither is visible from this repo, so without them Themis can only ask about a cross-repo contract rather than check it. The clones are read-only and use a token the agent never receives. If the App lacks Contents: Read on either repo the run degrades to a review without that context instead of failing.
This comment was marked as off-topic.
This comment was marked as off-topic.
austinderrick
marked this pull request as draft
August 11, 2026 22:44
The caller stub could never have worked. GitHub does not let a public repository call a reusable workflow stored in a private one, and curator-helm is the only public repo in the Themis fleet -- every run since the first push died at startup, which doesn't surface in the checks rollup. CuratorAgents already grants organization-level access; that setting doesn't extend to public callers. Going private isn't available to us either: interworks.github.io/curator-helm is the HelmRepository every site pulls charts from. So this vendors themis-review.yml at 403cc42 (themis-v1.35.0) with each input frozen to what the stub passed, and documents the re-sync recipe plus the deliberate deltas in the header. Checking out the private CuratorAgents assets with the app token still works -- only `uses:` is barred, not authenticated reads. Two guards the shared reusable doesn't need: fork PRs are skipped (a public repo's fork PR gets no secrets, so the mint would fail and redden an outside contributor's PR) and Bot authors are skipped.
austinderrick
marked this pull request as ready for review
August 12, 2026 13:36
![themis-iw[bot]](https://avatars.githubusercontent.com/in/3692149?s=60&v=4){kind=small}
There was a problem hiding this comment.
Tip
✅ APPROVED
The commit I last reviewed (81b0121) no longer exists in this branch's history, but the content is unchanged: every commit here (429a510 through 274c521) carries the same message and the same diff as what I already reviewed, just re-hashed by a rebase onto a newer main. I diffed the final commit, "ci: pin the vendored workflow's actions to SHAs," against what I'd already approved and it's byte-identical: create-github-app-token, github-script, checkout (both call sites), and claude-code-action are all still SHA-pinned with a version comment, and the KNOWN LIMITATION note on the approved-PR fast path (tracked as InterWorks/CuratorAgents#389) is still in place.
No new commits, no new issues.
-- Themis, Titan of Divine Law and Order
Every other workflow here pins third-party actions to a commit SHA with a version comment, and REVIEW.md -- added in this same PR -- says to flag a mutable-tag pin. The vendored copy carried upstream's mutable tags, so it violated the rule it ships alongside. Pins create-github-app-token, github-script, checkout, and claude-code-action, and records the divergence from upstream in the header so a re-sync doesn't silently undo it. Also documents the fast-path limitation Themis found: the gate keys on an APPROVED review state that comment_only mode never produces, so an approved PR pays for a full review on every push. Left as-is here and filed upstream as CuratorAgents#389, since fixing it only in this copy would make the two harder to diff.
austinderrick
force-pushed
the
ci/themis-review
branch
from
August 12, 2026 16:14
81b0121 to
274c521
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installs Themis on this repo, set up the same way as
iac-interworks.What this adds
.github/workflows/claude-code-review.yml— thin caller stub delegating to the canonicalthemis-reviewreusable inInterWorks/CuratorAgents:403cc42(themis-v1.35.0) rather than the mutable@mainref. Renovate keeps the digest current viahelpers:pinGitHubActionDigests.comment_only: true— every review posts as a non-blockingCOMMENT, so Themis never green-checks or blocks a PR.include_cross_bot_conventions: false/include_lessons: false— this repo isn't part of the Curator bot ecosystem.if:skips Bot-authored PRs. Here that covers Renovate (digest/action/npm bumps) and release-please (the version-bump + CHANGELOG PR); neither has a diff a review can add value to.REVIEW.md— the review spec, written for this repo rather than copied.CONTRIBUTING.mdstays the development guide; this is the review guide, the same splitiac-interworksuses withCLAUDE.md.What REVIEW.md encodes
cronjob, both bootstrap jobs,configmap,pvc,externalsecrets-*andmariadb-*are unverified, as is every conditional branch no suite sets.helm lint, or secret scanner runs here, unlikeiac-interworks. Invalid manifests and leaked credentials reachmainunless a reviewer catches them, so both are explicitly in scope.iac-interworksconsume it, so a rename needsfeat!:and a changed default is a fleet-wide change.DB_HOSTis set in four templates outside the shared_env.tplblock, and the-primarysuffix on the two write-path jobs is deliberate. Three of the last fivefix:commits (fix(curator): add DB_HOST to cronjob #70, fix(curator): fix last case mariadbEndpoint #73, fix(curator): adds-primaryto db_host to avoid read-only replicas #75) were in exactly this code.version/CHANGELOG.md/ the manifest, image-pin rules, the*_test.yamldiscovery gotcha, and the comment-only must-fix bar.Sibling-repo context.
context_repos(added in CuratorAgents#387, shipped inthemis-v1.35.0) checks outcuratorandiac-interworksread-only into.themis-context/for each review, so Themis can verify a cross-repo contract instead of only asking about it — who still passes a values key this diff renames, whether a chart-rendered env var matches what the app actually reads. The clones use a token the agent never receives, and a missing grant degrades to a review without that context rather than a failure.Before this can run
vars.THEMIS_GH_APP_ID,secrets.THEMIS_GH_APP_PRIVATE_KEY, andsecrets.THEMIS_ANTHROPIC_API_KEYare already scoped to this repo at the org level (verified). Two grants need confirming, and I can't read the App's selected-repo list to check either:InterWorks/curator-helm(Pull requests: Write). Without it the token mint fails on the first run.InterWorks/curatorandInterWorks/iac-interworksfor the context clones. Both already run Themis, so the App is installed on them, but the clone needs Contents specifically. If it's missing the symptom is quiet: a::warning::in the job log and reviews that silently skip the cross-repo checks.Testing
The workflow only fires on
pull_request, so this PR is its own first test — if Themis comments below, the wiring works end to end.